# Vulnerabilities published in 2026


- [CVE-2026-19651](https://insights.sbomify.com/CVE-2026-19651/): IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities (high 7.4)
- [CVE-2026-19650](https://insights.sbomify.com/CVE-2026-19650/): Cross-Site Request Forgery (CSRF) in GitLab (high 7.1)
- [CVE-2026-1965](https://insights.sbomify.com/CVE-2026-1965/): bad reuse of HTTP Negotiate connection (medium 6.5)
- [CVE-2026-19649](https://insights.sbomify.com/CVE-2026-19649/): IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs (medium 6.2)
- [CVE-2026-19646](https://insights.sbomify.com/CVE-2026-19646/): Open redirect in Common Licensing (critical 9.1)
- [CVE-2026-19645](https://insights.sbomify.com/CVE-2026-19645/): Multiple vulnerabilities in IBM MQ Agent images (medium 6.5)
- [CVE-2026-19644](https://insights.sbomify.com/CVE-2026-19644/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-19643](https://insights.sbomify.com/CVE-2026-19643/): Out-of-bounds read in the Base64 decoder in Amazon aws-sdk-cpp on signed-char platforms (medium 6.0)
- [CVE-2026-19642](https://insights.sbomify.com/CVE-2026-19642/): Out-of-bounds write in the Base64 decoder in Amazon aws-sdk-cpp (medium 6.0)
- [CVE-2026-19641](https://insights.sbomify.com/CVE-2026-19641/): Denial of service in EOS (medium 6.9)
- [CVE-2026-19640](https://insights.sbomify.com/CVE-2026-19640/): Security Advisory 0170 (low 2.3)
- [CVE-2026-1964](https://insights.sbomify.com/CVE-2026-1964/): WeKan REST Endpoint boards.js BoardTitleRESTBleed access control (medium 5.3)
- [CVE-2026-19639](https://insights.sbomify.com/CVE-2026-19639/): Improper Access Control (medium 5.3)
- [CVE-2026-19636](https://insights.sbomify.com/CVE-2026-19636/): Insuffucient Protections Lead to Brute Force (medium 6.0)
- [CVE-2026-19635](https://insights.sbomify.com/CVE-2026-19635/): Local Privilege Escalation (high 8.5)
- [CVE-2026-19634](https://insights.sbomify.com/CVE-2026-19634/): SQL injection in PostgreSQL Anonymizer (medium 6.4)
- [CVE-2026-19633](https://insights.sbomify.com/CVE-2026-19633/): PostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueries (high 8.8)
- [CVE-2026-19632](https://insights.sbomify.com/CVE-2026-19632/): TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure (critical 9.8)
- [CVE-2026-19631](https://insights.sbomify.com/CVE-2026-19631/): SQL Injection (medium 6.9)
- [CVE-2026-19630](https://insights.sbomify.com/CVE-2026-19630/): Amplified resource exhaustion in inbound message processing (high 7.5)
- [CVE-2026-1963](https://insights.sbomify.com/CVE-2026-1963/): WeKan Attachment Storage attachments.js MoveStorageBleed access control (medium 5.3)
- [CVE-2026-19629](https://insights.sbomify.com/CVE-2026-19629/): Privilege Escalation (high 8.6)
- [CVE-2026-19628](https://insights.sbomify.com/CVE-2026-19628/): Remote Code Execution (high 8.6)
- [CVE-2026-19627](https://insights.sbomify.com/CVE-2026-19627/): IBM Planning Analytics Local is affected by security vulnerabilities (high 8.2)
- [CVE-2026-19626](https://insights.sbomify.com/CVE-2026-19626/): Remote Code Execution (critical 9.4)
- [CVE-2026-19625](https://insights.sbomify.com/CVE-2026-19625/): IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities (medium 5.3)
- [CVE-2026-19624](https://insights.sbomify.com/CVE-2026-19624/): NetworkManager-l2tp: local privilege escalation via ipsec.conf injection (high 7.8)
- [CVE-2026-19622](https://insights.sbomify.com/CVE-2026-19622/): IBM Planning Analytics Local is affected by security vulnerabilities (high 8.8)
- [CVE-2026-19621](https://insights.sbomify.com/CVE-2026-19621/): Mattermost leaks interactive-message integration secrets to non-admin users via post-deletion events and thread reads (medium 6.5)
- [CVE-2026-19620](https://insights.sbomify.com/CVE-2026-19620/): IBM Planning Analytics Local is affected by security vulnerabilities (high 8.8)
- [CVE-2026-1962](https://insights.sbomify.com/CVE-2026-1962/): WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control (medium 5.3)
- [CVE-2026-19619](https://insights.sbomify.com/CVE-2026-19619/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (medium 4.7)
- [CVE-2026-19617](https://insights.sbomify.com/CVE-2026-19617/): Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser (medium 5.5)
- [CVE-2026-19616](https://insights.sbomify.com/CVE-2026-19616/): Information Disclosure in TBC Technology's KitLogistic (high 7.5)
- [CVE-2026-19615](https://insights.sbomify.com/CVE-2026-19615/): Admin and Site Enhancements < 9.0.1 - Author+ Stored XSS via SVG Upload over XML-RPC (medium 6.8)
- [CVE-2026-19614](https://insights.sbomify.com/CVE-2026-19614/): XML External Entity (XXE) Injection in CyberELF NanoXML (medium 5.3)
- [CVE-2026-19613](https://insights.sbomify.com/CVE-2026-19613/): ECS < 4.3.10 - Contributor+ Arbitrary Post Meta Disclosure via Dynamic Repeater ACF Source (medium 6.5)
- [CVE-2026-19612](https://insights.sbomify.com/CVE-2026-19612/): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (medium 5.4)
- [CVE-2026-19611](https://insights.sbomify.com/CVE-2026-19611/): Weak cryptography in Red Hat Build of Apache Camel 3.33.3.SP2 (high 7.4)
- [CVE-2026-19610](https://insights.sbomify.com/CVE-2026-19610/): Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean (medium 6.5)
- [CVE-2026-1961](https://insights.sbomify.com/CVE-2026-1961/): Forman: foreman: remote code execution via command injection in websocket proxy (high 8.0)
- [CVE-2026-19608](https://insights.sbomify.com/CVE-2026-19608/): Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policies (medium 5.3)
- [CVE-2026-19607](https://insights.sbomify.com/CVE-2026-19607/): Keycloak-services: keycloak-services: broker-originated username collision causes account lockout (medium 5.3)
- [CVE-2026-19603](https://insights.sbomify.com/CVE-2026-19603/): Private channel ID disclosure via user status endpoints (medium 4.3)
- [CVE-2026-19601](https://insights.sbomify.com/CVE-2026-19601/): Disclosure of AD/LDAP bind password via Test Connection (medium 4.9)
- [CVE-2026-19600](https://insights.sbomify.com/CVE-2026-19600/): Mattermost logs plaintext authentication tokens in debug-level server logs on failed auth attempts (medium 4.5)
- [CVE-2026-1960](https://insights.sbomify.com/CVE-2026-1960/): Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes (medium 5.1)
- [CVE-2026-19599](https://insights.sbomify.com/CVE-2026-19599/): Remote Code Execution vulnerability (critical 9.9)
- [CVE-2026-19598](https://insights.sbomify.com/CVE-2026-19598/): Auth bypass in Pods – Custom Content Types and Fields (critical 9.8)
- [CVE-2026-19596](https://insights.sbomify.com/CVE-2026-19596/): OpenNMS XML collector XXE allows arbitrary file read from the OpenNMS host (medium 5.9)
- [CVE-2026-19595](https://insights.sbomify.com/CVE-2026-19595/): Zephyr RTIO syscall verifier validates output parameters for read instead of write access (medium 6.1)
- [CVE-2026-19594](https://insights.sbomify.com/CVE-2026-19594/): Path traversal in Snowflake Python APIs (high 8.1)
- [CVE-2026-19593](https://insights.sbomify.com/CVE-2026-19593/): Code injection in Codex Desktop (critical 9.8)
- [CVE-2026-19592](https://insights.sbomify.com/CVE-2026-19592/): Code injection in Codex CLI (high 7.3)
- [CVE-2026-19591](https://insights.sbomify.com/CVE-2026-19591/): Security feature bypass in Codex CLI (high 8.8)
- [CVE-2026-19590](https://insights.sbomify.com/CVE-2026-19590/): Code injection in Codex Desktop (high 7.3)
- [CVE-2026-1959](https://insights.sbomify.com/CVE-2026-1959/): Stored Cross-Site Scripting (XSS) vulnerability in Loggro Pymes (medium 5.1)
- [CVE-2026-19589](https://insights.sbomify.com/CVE-2026-19589/): Packer vulnerable to arbitrary file write via crafted plugin archive during installation (high 7.1)
- [CVE-2026-19588](https://insights.sbomify.com/CVE-2026-19588/): Integer overflow in rlottie (medium 6.5)
- [CVE-2026-19587](https://insights.sbomify.com/CVE-2026-19587/): Denial of service in rlottie (medium 6.5)
- [CVE-2026-19586](https://insights.sbomify.com/CVE-2026-19586/): Pre-Authentication OS Command Injection in Omada Gateways on OpenVPN Server in Omada Gateways (critical 9.3)
- [CVE-2026-19585](https://insights.sbomify.com/CVE-2026-19585/): Go-getter vulnerable to a path traversal in S3/GCS directory download handling (medium 5.3)
- [CVE-2026-19584](https://insights.sbomify.com/CVE-2026-19584/): Velociraptor VQL injection during notebook restore from backup (high 7.7)
- [CVE-2026-19583](https://insights.sbomify.com/CVE-2026-19583/): Velociraptor Required Permissions bypass by using client monitoring queries (critical 9.9)
- [CVE-2026-1958](https://insights.sbomify.com/CVE-2026-1958/): Hard-coded passwords in KlinikaXP (high 8.7)
- [CVE-2026-19579](https://insights.sbomify.com/CVE-2026-19579/): Snipe-IT Checkout Request Cancellation IDOR (medium 5.3)
- [CVE-2026-19577](https://insights.sbomify.com/CVE-2026-19577/): Out-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer address (high 7.1)
- [CVE-2026-19576](https://insights.sbomify.com/CVE-2026-19576/): Memory corruption in zephyr (medium 6.8)
- [CVE-2026-19575](https://insights.sbomify.com/CVE-2026-19575/): Type confusion in the device_deinit system call allows user-mode threads to execute arbitrary kernel code (high 7.8)
- [CVE-2026-19574](https://insights.sbomify.com/CVE-2026-19574/): ARM64 MMU can assign an in-use ASID to a new memory domain, breaking user-mode memory isolation (high 7.0)
- [CVE-2026-19573](https://insights.sbomify.com/CVE-2026-19573/): Affiliate Super Assistent <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via ‘doCommentShortcode’ function (high 7.2)
- [CVE-2026-19572](https://insights.sbomify.com/CVE-2026-19572/): FlexNet Publisher lmadmin SOAP Authentication Bypass Vulnerability (critical 9.3)
- [CVE-2026-19571](https://insights.sbomify.com/CVE-2026-19571/): Race condition in zephyr (medium 6.7)
- [CVE-2026-19570](https://insights.sbomify.com/CVE-2026-19570/): Out-of-bounds write in LE Audio Broadcast Sink when copying BASE subgroup metadata into the BASS receive state (high 8.8)
- [CVE-2026-19569](https://insights.sbomify.com/CVE-2026-19569/): Integer overflow in dynamic kernel object allocation allows user-mode threads to corrupt the kernel heap (high 8.8)
- [CVE-2026-19568](https://insights.sbomify.com/CVE-2026-19568/): SVG File Parsing Memory Corruption Vulnerability in Autodesk 3ds Max (high 7.8)
- [CVE-2026-19566](https://insights.sbomify.com/CVE-2026-19566/): Denial of service in Net::CIDR::Set (high 7.5)
- [CVE-2026-19565](https://insights.sbomify.com/CVE-2026-19565/): Apache::AppSamurai::Util versions through 1.01 for Perl generate predictable session authentication keys from the clock and process id in CreateSessionAuthKey. (low 3.7)
- [CVE-2026-19560](https://insights.sbomify.com/CVE-2026-19560/): Use after free in Chrome (high 8.8)
- [CVE-2026-19559](https://insights.sbomify.com/CVE-2026-19559/): Use after free in Chrome (high 8.8)
- [CVE-2026-19558](https://insights.sbomify.com/CVE-2026-19558/): Use after free in Chrome (high 7.5)
- [CVE-2026-19557](https://insights.sbomify.com/CVE-2026-19557/): Use after free in Chrome (high 8.3)
- [CVE-2026-19556](https://insights.sbomify.com/CVE-2026-19556/): Use after free in Chrome (high 8.8)
- [CVE-2026-19553](https://insights.sbomify.com/CVE-2026-19553/): SSLContext.wrap_bio() missing validation of server_hostname parameter (high 7.6)
- [CVE-2026-19550](https://insights.sbomify.com/CVE-2026-19550/): Missing authorization in Red Hat Enterprise Linux 10 (high 8.2)
- [CVE-2026-19548](https://insights.sbomify.com/CVE-2026-19548/): Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing (medium 5.5)
- [CVE-2026-19547](https://insights.sbomify.com/CVE-2026-19547/): Local Privilege Escalation in Ghostscript for Windows (high 7.0)
- [CVE-2026-19546](https://insights.sbomify.com/CVE-2026-19546/): Dbi: incomplete fix for cve-2026-14380 dbi: arbitrary code execution via caller-influenced profile attribute (high 8.8)
- [CVE-2026-19543](https://insights.sbomify.com/CVE-2026-19543/): Security feature bypass in Common Licensing (medium 6.2)
- [CVE-2026-19542](https://insights.sbomify.com/CVE-2026-19542/): Stack-based out-of-bounds write in tdelete during tree rebalancing (medium 5.6)
- [CVE-2026-19541](https://insights.sbomify.com/CVE-2026-19541/): Outgoing OAuth connection client secret exposure during connection validation (medium 6.5)
- [CVE-2026-19539](https://insights.sbomify.com/CVE-2026-19539/): IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion (high 8.6)
- [CVE-2026-19538](https://insights.sbomify.com/CVE-2026-19538/): Bypass of BLOCKED ACL items on proxy protocol port over TCP or TLS (high 8.2)
- [CVE-2026-19535](https://insights.sbomify.com/CVE-2026-19535/): Cross-site request forgery in EKI-1242EIMS (high 8.6)
- [CVE-2026-19534](https://insights.sbomify.com/CVE-2026-19534/): undici vulnerable to Denial of Service via unrequested WebSocket subprotocol (high 7.5)
- [CVE-2026-19532](https://insights.sbomify.com/CVE-2026-19532/): Path Traversal in HAVELSAN's Liman MYS (medium 5.3)
- [CVE-2026-1953](https://insights.sbomify.com/CVE-2026-1953/): Stored Cross Site Scripting(XSS) in Nukegraphic CMS V3.1.2 (high 8.2)
- [CVE-2026-1952](https://insights.sbomify.com/CVE-2026-1952/): Denial of service via the undocumented subfunction in AS320T (critical 9.8)
- [CVE-2026-19519](https://insights.sbomify.com/CVE-2026-19519/): Claircore: claircore: denial of service via unchecked type assertion in rpm header parser (medium 4.3)
- [CVE-2026-19518](https://insights.sbomify.com/CVE-2026-19518/): Other in rlottie (medium 6.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/823/